TI-2026-32787 Aliases CVE-2026-44917 GHSA-3g4p-c74p-mh7x

OpenStack Ironic before 35.0.2 allows a malicious authenticated project admin or manager…

LOW 22CWE-669Published 2026-06-04 · Updated 2026-06-04

Key facts

Attack vector: Network
Privileges required: High
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · None · None
Fix status: Partial Red Hat: 5 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.

Summary

OpenStack Ironic before 35.0.2 allows a malicious authenticated project admin or manager to read local files on the Ironic conductor via a pxe_template.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00283 20th percentileScored 2026-11-07

Fix Partial Ironic (OpenStack): 26.1.7, 29.0.6, 32.0.2 +1Red Hat: 5 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
OpenStack	Ironic	17.0.0 to before 26.1.7; 27.0.0 to before 29.0.6; 30.0.0 to before 32.0.2; 33.0.0 to before 35.0.2	26.1.7, 29.0.6, 32.0.2, 35.0.2	Patch available	CNA

Ironic VendorOpenStack Affected 17.0.0 to before 26.1.7; 27.0.0 to before 29.0.6; 30.0.0 to before 32.0.2; 33.0.0 to before 35.0.2 Fixed in 26.1.7, 29.0.6, 32.0.2, 35.0.2 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:openstack:ironic::::::::	17.0.0 to before 26.1.7; 27.0.0 to before 29.0.6; 30.0.0 to before 32.0.2; 33.0.0 to before 35.0.2	Vulnerable	OpenStack

cpe:2.3:a:openstack:ironic:*:*:*:*:*:*:*:* Versions 17.0.0 to before 26.1.7; 27.0.0 to before 29.0.6; 30.0.0 to before 32.0.2; 33.0.0 to before 35.0.2 Vulnerable ·OpenStack

Remediation

Fix · CNA Ironic (OpenStack) Fixed in 26.1.7, 29.0.6, 32.0.2, 35.0.2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-06-04
OpenStack Ironic 26.1.7, 29.0.6 and 2 more versions
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2026-35966 Path traversal in OpenStack IronicPriority LOW 38
Show all 2 records →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat OpenShift Container Platform 4	Affected	No fix yet: Fix deferred
Red Hat OpenStack Platform 13 (Queens)	Affected	No fix planned: Out of support scope
Red Hat OpenStack Platform 16.2	Affected	No fix planned: Out of support scope
Red Hat OpenStack Platform 17.1	Affected	No fix planned: Out of support scope
Red Hat OpenStack Platform 18.0	Affected	No fix yet: Fix deferred

Timeline

2026-10-02 Threatist record created from CVE-2026-44917
2026-10-03 Alias added: GHSA-3g4p-c74p-mh7x
2026-10-09 Affected versions changed · Red Hat
2026-10-09 CVSS score added · Red Hat

References

Advisory 2

Other 1

https://bugs.launchpad.net/ironic/+bug/2148319

TI-2026-37300 Resource allocation without limits in OpenStack Ironic CVSS 3.1HIGH 7.5
TI-2026-32789 In OpenStack Ironic through 35.x before a3f6d73, during image handling, an infinite loop… CVSS 3.1MEDIUM 6.5
TI-2026-35966 Path traversal in OpenStack Ironic CVSS 3.1HIGH 8.1
TI-2026-31177 An issue was discovered in idrac in OpenStack Ironic before 35.0.1. CVSS 3.1HIGH 7.7
TI-2026-30793 OpenStack Ironic before 35.0.1 allows ipmitool execution in a non-default configuration that has a console interface. CVSS 3.1HIGH 7.2
TI-2026-34153 OpenStack Ironic before 35.0.2 allows Boot Script Injection of an iPXE script if the… CVSS 3.1HIGH 7.7

See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences